14652 matches found
Kestra <= 1.3.20 - Remote Code Execution
Kestra = 1.3.20 contains an authentication bypass caused by misclassification of /configs endpoint in REST API filter, letting unauthenticated attackers create and execute root-level tasks, exploit requires unauthenticated access to /configs endpoint. id: CVE-2026-53576 info: name: Kestra = 1.3.2...
EUVD-2026-64603
docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...
CVE-2026-78122
docker-socket-proxy (Tecnativa) through 0.5.0 has an insufficient access control granularity flaw in the /containers Docker API namespace. When the CONTAINERS environment variable is set, read endpoints (/containers/{id}/archive, /export, /logs, /top) are not properly gated, allowing an unauthent...
CVE-2026-74667
In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...
CVE-2026-74628
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...
CVE-2026-74589
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...
CVE-2026-74666 packet: synchronize pressure clearing with ring reconfiguration
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packetsetring updates the RX ring state under skreceivequeue.lock, but used to publish the tpacket receive mode through po-prothook.func after releasing that lock...
CVE-2026-74667
CVE-2026-74667 is a Linux kernel out-of-bounds read in the net/packet subsystem. The function packet_parse_headers() only resets skb->mac_header for unbound SOCK_RAW sockets, leaving it unset for protocol-bound SOCK_RAW, SOCK_DGRAM, and SOCK_PACKET frames. When such frames are transmitted via ...
CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path
In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...
CVE-2026-74667
In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...
EUVD-2026-64354
In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...
CVE-2026-74666
This vulnerability affects the Linux kernel AF_PACKET (packet socket) subsystem. A race condition exists in packet_set_ring(): the tpacket receive mode was published via po->prot_hook.func after releasing sk_receive_queue.lock, while the RX ring state was already updated under that lock. This ...
CVE-2026-74628
This is a use-after-free vulnerability in the Linux kernel's net/x25 subsystem. The X.25 timers are armed with mod_timer() and cancelled with timer_delete(), which means a pending timer holds no reference to the socket. Because x25_heartbeat_expiry() rearms the timer unconditionally, it can reins...
EUVD-2026-64565
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...
CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...
CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...
CVE-2026-74615
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not arm the ageing timer on a device that is down vxlanchangelink arms vxlan-agetimer whenever the requested ageing interval differs from the configured one: if conf.ageinterval != vxlan-cfg.ageinterval...
CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...
PT-2026-79633
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod timer and cancelled with timer delete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback alread...
PT-2026-79671
In the Linux kernel, the following vulnerability has been resolved: packet: synchronize pressure clearing with ring reconfiguration packet set ring updates the RX ring state under sk receive queue.lock, but used to publish the tpacket receive mode through po-prot hook.func after releasing that...